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Independent Orbiter Assessment 
Analysis of the Body Flap Subsystem 


1 . 0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company ( MDAC ) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List (CIL) . Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206 , Instructions 
for Preparation of FMEA and CIL, 10 October 1986 . The IOA 
approach features a top-down analysis of the hardware to 
determine failure modes, criticality, and potential critical 
items. To preserve independence, this analysis was accomplished 
without reliance upon the results contained within the NASA 
FMEA/CIL documentation. This report documents (Appendix C) the 
independent analysis results for the Orbiter Body Flap (BF) 
subsystem hardware. 

The BF is a large aerosurface located at the trailing edge of the 
lower aft fuselage of the Orbiter. The proper function of the BF 
is essential during the dynamic flight phases of ascent and 
entry. During the ascent phase of flight, the BF trails in a 
fixed position. For entry, the BF provides elevon load relief, 
trim control, and acts as a heat shield for the main engines. 

Specifically, the BF hardware comprises the following components: 

o Power Drive Unit (PDU) 

o Rotary Actuators 

o Torque Tubes 


The IOA analysis process utilized available BF hardware drawings 
and schematics for defining hardware assemblies, components, and 
hardware items. Each level of hardware was evaluated and 
analyzed for possible failure modes and effects. Criticality was 
assigned based upon the severity of the effect for each failure 
mode. 
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Figure 1 presents a summary of the failure criticalities for each 
of the three major divisions of the BF. A summary of the number 
of failure modes, by criticality, is also presented below with 
Hardware (HW) criticality first and Functional (F) criticality 
second - 


+ + 

j Summary of IOA Failure Modes By Criticality (HW/F) j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

Number : 

9 

3 


15 

- 

8 

35 


For each failure mode identified, the criticality and redundancy 
screens were examined to identify critical items . A summary of 
Potential Critical Items (PCIs) is presented as follows: 


+ — — — *- 

j Summary of IOA Potential Critical Items (HW/F) j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

Number : 

L_, - 

9 

3 

- 

7 

- 

19 


Of the 35 failure modes analyzed, 19 were determined to be PCIs. 
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2 . 0 INTRODUCTION 


2.1 Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS). The NSTS Office has 
undertaken the task of reevaluating the FMEA/CIL for the Space 
Shuttle design. The MDAC is providing an independent assessment 
of the Orbiter FMEA/CIL for completeness and technical accuracy. 


2.2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items. Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the NASA and Prime Contractor FMEA/CIL 
reevaluation results. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEAs/CILs that is 
performed and documented at a later date. 


Step 1.0 Subsystem familiarization 

1.1 Define subsystem functions 

1.2 Define subsystem components 

1 . 3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2.3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3 . 1 Construct matrix of failure modes 

3.2 Document IOA analysis results 
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Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4 . 2 Review in-house 

4 . 3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 BF Ground Rules and Assumptions 

The BF ground rules and assumptions used in the IOA are defined 
in Appendix B. 



3 . 0 SUBSYSTEM DESCRIPTION 


The following sections describe the BF actuator system hardware. 
This hardware comprises a PDU, rotary actuators, and torque 
tubes. An overview of the system components is shown in Figure 2. 

3.1 Design and Function 

The BF is a large aerosurface at the trailing edge of the lower 
aft fuselage of the Orbiter. The proper function of the BF is 
essential during the ascent phases of flight. During ascent, the 
BF trails in a fixed position. For entry, the BF provides elevon 
load relief, trim control, and acts as a main engine heat shield. 

The BF system design provides a triple redundancy, electronically 
controlled hydro-mechanical drive system. The Flight Control 
System (FCS) provides signals to the Aerosurface Servo Amplifier 
(ASA) which commands valve packs supplying pressurized fluid to 
power hydraulic motors. These motors drive torque tubes which 
power rotary actuators and move the BF aerosurface. 

The BF PDU comprises three in-line filters, three enable solenoid 
valves, six pilot solenoid valves, three power spool assemblies, 
one summing link, three hydraulic motor/brake assemblies, and a 
PDU geartrain assembly (Figure 3). 

Three Orbiter hydraulic loops, each corresponding to an Auxiliary 
Power Unit (APU), supply fluid pressure for the BF drive system. 
Each PDU is protected by an in-line hydraulic fluid filter up- 
stream of the solenoid valves. Nominally, three hydraulic loops 
are used to drive the BF. Full BF performance can be maintained 
using two hydraulic systems. One hydraulic drive system can 
power the BF at full force, but at half rate. 

Each enable solenoid valve (Figure 4) controls the flow of 
hydraulic fluid to the downstream pilot solenoid valves. These 
solenoids contains a normally closed valve. A coil spring 
provides the restoring force which maintains a closed valve 
position. When energized by an ASA signal, the solenoid provides 
a force which overcomes the return spring and allows fluid to 
pressurize downstream pilot solenoid valves. 

The BF pilot solenoid valves divert hydraulic fluid and pressure 
to the downstream control actuator or power spool. The upstream 
enable solenoid valve must be opened before hydraulic fluid and 
pressure can flow to the pilot solenoid valves. When an up or 
down pilot solenoid valve is selected and activated, hydraulic 
fluid flows thru the control actuator and rotates the hydraulic 
motor in the corresponding direction. 

The power spools control the flow of hydraulic fluid and pressure 
to the hydraulic motor/brake assemblies. The power spools are 
situated downstream of the hydraulic inlet and the enable/pilot 
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Figure 3 - BODY FLAP POWER DRIVE UNIT (PDU) 
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solenoid valves. The three power spools are mechanically 
connected by two summing links. The actuators will translate in 
one direction for an up command and in the opposite direction for 
a down command . 

The BF actuator recirculation valve is used to divert hydraulic 
fluid around the actuator if system pressure drops bel ow 850 psi. 
When hydraulic system pressure is in a nominal range 
(approximately 3000 psi), the recirculation valve is open and 
fluid pressurizes the BF actuator. 

The summing link is designed to mechanically synchronize the 
movement of the BF power spools. If one power spool fails to 
operate (i.e. jammed solenoid valve, loss of ASA signal, etc.), 
one piston is capable of dragging the remaining two systems thru 
the summing link to their proper positions. This will direct 
hydraulic fluid to the motor/brake assemblies and permit them to 
operate nominally. 

The hydraulic motor/brake assembly comprises a hydraulic motor 
and brake (Figure 5). The hydraul ic motor an d brake share a 
common centerline shaft. Each of three hydraulic motor/brake 
assemblies convert 3000 psi fluid pressure to rotary shaft 
motion. The assemblies also prevent the differential gearbox 
from back-driving when the systems are unpressurized. 

The hydraulic motor converts hydraulic fluid pressure to rotary 
motion of the differential gearbox input torque tubes. The motor 
contains a rotating barrel housing multiple pistons. As each 
piston passes by the inlet, hydraulic pressure forces each piston 
out of the rotary barrel transferring force to the motor's fixed 
ramp wobble-plate which rotates the shaft. This shaft extends 
out of the motor housing into the hydraulic brake portion of the 
assembly.^ — - ----- = : . -»»- .••• . • 

The hydraulic brake is situated between the hydraulic motor and 
the differential gearbox input torque tubes. The brake is 
normally engaged, preventing the common motor/brake assembly 
shaft from rotating or back-driving. When fluid pressure is 
diverted to the hydraulic brake, it disengages and the shaft 
transmits rotary power to its corresponding torque tube. 

The PDU geartrain assembly (Figure 6) comprises three input 
torque tubes, a differential gearbox, and one output driveshaft. 
The splined input torque tubes transmit rotary shaft power from 
the hydraulic motor/brake assembly to the differential gearbox. 
The differential gearbox sums the input of three hydraulic motor 
torque tubes into one output shaft. The gearbox uses two sets of 
planetary gears to sum the torque tube inputs . One driveshaft 
transmits the output of the differential gearbox to a beveled 
gear. The full performance of the BF can be maintained with two 
torque tube inputs. The BF can be driven at half-speed with one 
torque tube input. 
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The PDU geartrain assembly contains two 35-watt heaters mounted 
to the gearbox. These heaters are used when the vehicle's 
attitude is thermally cold. 

The PDU geartrain assembly output driveshaft position is measured 
by a four Rotary Variable Differential Transformers (RVDTs) 
mounted on a common bracket. Any one of the four RVDTs is 
capable of measuring the driveshaft position. ASA channel four 
receives the RVDTs output and transmits them to the GPCs for 
determining BF position. 

The rotary actuators (Figure 7) connect the BF to the Orbiter and 
provide the hinge-moment required to move the surface up or 
down. The rotary actuators receive torque and power from four 
torque tubes (Figure 8) connected to the beveled gear at the PDU 
gearbox driveshaft. 


3.2 Interfaces and Locations 

The BF system hardware is located at the trailing edge of the 
Orbiter' s lower fuselage. The BF system interfaces with the 
Orbiter 's three hydraulic systems (each corresponding to one 
APU) . The BF system hardware interfaces with the ASAs which in 
turn interface with the FCS portion of the GPCs for system 
control actuation and feedback. 


3.3 Hierarchy 

Figure 2 illustrates the hierarchy of the BF hardware components. 
Figures 3 through 8 depict the functional details of the BF 
system components. 
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Figure 7 - GEARED ROTARY ACTUATOR 
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Figure 8 - TYPICAL TORQUE TUBE 
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4 . 0 ANALYSIS RESULTS 


Detailed analysis results for each of the identified failure 
modes are presented in Appendix C. Table I presents a summary of 
the failure criticalities. Further discussion of each of these 
subdivisions and the applicable failure modes is provided in 
subsequent paragraphs. 


+ 1 

[ TABLE I Summary of IOA Failure Modes and Criticalities 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

PDU 

7 

3 

— 

15 

— 

8 

33 

Rotary Act. 

1 

- 

- 

- 

- 

- 

1 

Torque Tubes 

1 

— 

— 


— 

— 

1 

TOTAL 

H 

9 

3 

- 

15 

- 

8 

35 


Of these 35 failure modes analyzed, 19 were determined to be 
PCIs. A summary of the PCls is presented in Table II. Appendix 
D contains a cross reference between each PCI and analysis work- 
sheets in Appendix C. 


+ + 

I TABLE II Summary of IOA Potential Critical Items j 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

PDU 

7 

3 


7 

— 

17 

Rotary Act. 

1 

- 

- 

- 

- 

1 

Torque Tubes 

1 


— 

— 


1 

+ 


+ + 

| TOTAL | 9 | 3 I - | 7 | - | 19 | 


+ + 


4.1 Power Drive Unit 

Critical failures of the PDU components can be caused by: 
plugged filters, jammed or failed control valves, jammed or 
fractured summing links, plugged supply orifices, failed or 
fractured hydraulic motor/brake assemblies, and fractured or 
jammed differential gears and shafts. 



4.2 Geared Rotary Actuator 


Critical failure modes of the geared rotary actuator can be 
caused by: a fractured or open shaft, and a fractured or open 

gear within the rotary actuator. 

4 . 3 Torque Tubes 

Critical failure modes of the torque tubes can be caused by a 
fractured or open torque tube. 



5 . 0 REFERENCES 
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5. STS82-0039A: 
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7. SD72-SH-0102-9 


Instructions for Preparation of Failure 
Modes and Effects Analysis ( FMEA ) and 
Critical Items List (CIL) 

October 10, 1986 

The FCS/Effectors Training Manual 
February 1986 

MOD Drawings - applicable pages 

Rockwell Drawings 

Applicable CIL Sections 

Space Shuttle Technical Conference 
Part 2, pp 905-19, June 28-30, 1983 

Requirements/Definition Document 
Aero Flight Control Mechanisms 
Rockwell International, Volume 2-9 
October 28, 1978 


The following references have been ordered, but were unavailable 
for the independent analysis: 

1 . SD72-SH-0102-6 : Requirements/Definition Document 

Hydraulic Subsystem 
Rockwell International 
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APPENDIX A 
ACRONYMS 



APU 

- Auxiliary Power Unit 

— 

ASA 

- Aerosurface Servo Amplifier 


ASSY 

- Assembly 

— - 

BF 

- Body Flap 


BRK 

- Brake 


CIL 

- Critical Items List 


F 

- Functional 


FCS 

- Flight Control System 


FM 

- Failure Mode 


FMEA 

- Failure Modes and Effects Analysis 

■ 

GPC 

- General Purpose Computer 

m--^s 

HYD 

- Hydraulic, Hydraulics 


HW 

- Hardware 

1 

IOA 

- Independent Orbiter Assessment 

- " 

MDAC 

- McDonnell Douglas Astronautics Company 


MTR 

- Motor 


NA 

- Not Applicable 


NASA 

- National Aeronautics and Space Administration 

— 

NSTS 

- National Space Transportation System 


PCI 

- Potential Critical Item 

«■ - 

PDU 

- Power Drive Unit 


psi 

- Pounds Per Square Inch 


psid 

- Pounds Per Square Inch Differential 


RVDT 

- Rotary Variable Differential Transformer 


RI 

- Rockwell International 

-- 

VLV 

- Valve 


xducer 

- Transducer 
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APPENDIX B 


DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

B.2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 


APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

Definitions contained in NSTS 22206 , Instructions For Preparation 
of FMEA/CIL , 10 October 1986 , were used with the following 
amplification s and addit ions. 

INTACT ABORT DEFINITIONS : 

RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9 , post-flight ^ '7 

ATO - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

CREDIBLE (CAUSE) - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /RATIONALE - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM) - major sub-mode of software operational sequence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
(PASS) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/obj ective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS : 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B . 2 IOA Project Level Ground Rules and Assumptions 


The philosophy embodied in NSTS 22206 , Instructions for 
Preparation of FMEA/CIL, 10 O ctober 1986" ^ was employed with the 
following amplifications and additions. 


1. The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
(FSSRs ) . 

RATIONALE: Software verification is out-of-scope of 
this task . . „ 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (C&W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All hardware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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6. All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs , and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

7. Verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required . 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8. The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP), pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.3 BF-Specific Ground Rules and Assumptions 


None. 
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APPENDIX C 
DETAILED ANALYSIS 


This section contains the IOA analysis worksheets generated 
during the analysis of this subsystem. The information on these 
worksheets is intentionally similar to the NASA FMEAs. Each of 
these sheets identifies the hardware item being analyzed, and 
parent assembly, as well as the function. For each failure mode, 
the possible causes are outlined, and the assessed hardware and 
functional criticality for each mission phase is listed, as 
described in the NSTS 22206, Instructions for Preparation of FMEA 
and CIL, 10 October 1986. Finally, effects are entered at - Ehe 
bottom of each sheet, and the worst case criticality is entered 
at the top. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 - Loss of life or vehicle 

2 ■ Loss of mission or next failure of any redundant item 

(like or unlike) could cause Toss of life/vehicle 

3 - All others 

Functional Criticalities: 

1R ■ Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R - Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 

Redundancy Screen A: 

1 - Is Checked Out PreFlight 

2 - Is Capable of Check Out PreFlight 

3 « Not Capable of Check Out PreFlight 
NA - Not Applicable 

Redundancy Screens B and C: 

P - Passed Screen 
F - Failed Screen 
NA - Not Applicable 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 9/16/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: BODY FLAP FLIGHT: 3/3 

MDAC ID: 101 ABORT: 3/3 

ITEM; ENABLE SOLENOID VALVE 

FAILURE MODE: FAILS OPEN 

LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) 

4) 

5) 

6) 

7) 

8 ) 

9) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/ SAFING: 


CRITICALITIES 
HDW/FUNC ABORT 


3/3 
3/3 
/ NA 
3/3 
3/3 


RTLS: 

TAL: 

AOA: 

ATO: 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC62 1-0056-0053 


CAUSES: BROKEN SPRING, CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

PRESSURE LEAKS PAST SOLENOID VALVE AND DOWNSTREAM SOLENOIDS ARE 
CONTINUOUSLY PRESSURIZED; NOMINAL SYSTEM FUNCTION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 
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INDEPENDENT ORBITER ASSESSMENT 
ORB I TER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 102 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: ENABLE SOLENOID VALVE 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) 

4) 

5) 

6) 

7) 

8 ) 

9) 



CRITICALITIES 

:ght phase 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

/NA 

AOA: 

DEORBIT: 

3/3 

ATO: 

LANDING/SAFING: 

3/1R 



HDW/FUNC 

3/1R 

3/1R 

3/1R 

3/1R 


REDUNDANCY SCREENS: A [ 2 ] B [ P ] 


C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: LOSS OF ASA CHANNEL 

EFFECTS/RATIONALE : 

SYSTEM CANNOT BE ACTIVATED; REMAINING TWO SYSTEMS OPERATE BODY 
FLAP NOMINALLY. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 103 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: ENABLE SOLENOID VALVE 

FAILURE MODE: FRACTURED HOUSING 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 

CAUSES: FATIGUE, VIBRATION 


EFFECTS/RATIONALE : 

SYSTEM PRESSURE DECAYS, HYDRAULIC BRAKE ENGAGES, RECIRCULATION 
VALVE OPEN DIVERTING FLOW TO RETURN; SYSTEM OPERATES NOMINALLY ON 
TWO SYSTEMS. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-4 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/1R 
3/1R 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) 

4) 

5) 

6) 

7) 

8 ) 

9) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


9/16/86 
BODY FLAP 
104 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


ENABLE SOLENOID VALVE 
LOSS OF HYDRAULIC PRESSURE 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

c [ p ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: LOSS OF HYDRAULIC PRESSURE 

EFFECTS/RATIONALE : 

SYSTEM PRESSURE DECAYS, HYDRAULIC BRAKE ENGAGES, RECIRCULATION 
VALVE OPEN DIVERTING FLOW TO RETURN? SYSTEM OPERATES NOMINALLY ON 
TWO SYSTEMS. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-5 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 105 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: PILOT SOLENOID VALVE (UP OR DOWN) 

FAILURE MODE: FAILS OPEN 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: BROKEN SPRING, CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

ONE PLOT SOLENOID VALVE REMAINS OPEN; OPPOSITE DIRECTION PILOT 
VALVE I S SELECTED PRESS URIZI NG BOTH SIDES O F DOW NSTREAM CONTROL 
VALVE. SUMMING LINK DRAGS POWER SPOOL TO PROPER POSITION. BF 
SYSTEM OPERATES NOMINALLY. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-6 


INDEPENDENT ORBITER ASSESSMENT 



ORBITER SUBSYSTEM 

ANALYSIS WORKSHEET 


DATE: 

9/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

BODY FLAP 

FLIGHT: 

3/1R 

MDAC ID: 

106 

ABORT: 

3/1R 

ITEM: 

PILOT SOLENOID 

VALVE (UP OR DOWN) 


FAILURE MODE: FAILS CLOSED 



LEAD ANALYST: J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4 ) 

5 ) 

6 ) 

7 ) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/ NA 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ) 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: LOSS OF ASA CHANNEL 

EFFECTS/RATIONALE : 

SYSTEM CANNOT BE ACTIVATED; REMAINING TWO SYSTEMS OPERATE BODY 
FLAP NOMINALLY. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-7 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 107 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: PILOT SOLENOID VALVE (UP OR DOWN) 

FAILURE MODE: FRACTURED HOUSING 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: FATIGUE, VIBRATION 


EFFECTS/RATIONALE : 

SYSTEM PRESSURES DECAYS, HYDRAULIC BRAKE ENGAGES, RECIRCULATION 
VALVE OPENS DIVERTING FLOW TO RETURN; SYSTEM OPERATES NOMINALLY 
ON TWO SYSTEMS. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-8 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/1R 
3/1R 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


9/16/86 
BODY FLAP 
108 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: PILOT SOLENOID VALVE (UP OR DOWN) 

FAILURE MODE: LOSS OF HYDRAULIC PRESSURE 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AO A: 

3/1R 

DEORBIT: 

LANDING/SAFING: 

3/1R 

3/3 

ATO: 

3/1R 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: LOSS OF HYDRAULIC PRESSURE 

EFFECTS/RATIONALE : 

SYSTEM PRESSURES DECAYS, HYDRAULIC BRAKE ENGAGES, RECIRCULATION 
VALVE OPENS DIVERTING FLOW TO RETURN; BF OPERATES NOMINALLY ON 
TWO SYSTEMS. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-9 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATES 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 109 


HIGHEST CRITICALITY HDW/FXJNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: ACTUATOR-CONTROL VALVE 

FAILURE MODE: FAILS NULL POSITION 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) ACTUATOR-CONTROL VALVE 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/ NA 

AOA: 

2/1R 

DEORBIT: 

2/1R 

ATO: 

2/1R 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A E 2 ] 

B [ P ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: LOSS OF ASA CHANNEL, GROSS FLUID LEAKAGE, LOSS OF SYSTEM 

PRESSURE 


EFFECTS/RATIONALE : 

REMAINING TWO SYSTEMS DRAG ACTUATOR WITH SUMMING LINK-NOMINAL 
SYSTEM OPERATION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-10 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
3/1R 
3/1R 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) ACTUATOR-CONTROL VALVE 

5) 

6 ) 

7) 

8 ) 

9 ) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


9/16/86 
BODY FLAP 
110 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


ACTUATOR-CONTROL VALVE 
FAILS TO RETURN 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

c [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: BROKEN RETURN SPRING 

EFFECTS/RATIONALE : 

REMAINING TWO SYSTEMS DRAG ACTUATOR WITH SUMMING LINK-NOMINAL 
SYSTEM OPERATION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-ll 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 111 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: ACTUATOR-CONTROL VALVE 

FAILURE MODE: JAMMED 

LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) ACTUATOR- CONTROL VALVE 

5) 

6 ) 

7) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 
3/3 
3/3 
/ NA 
1/1 
3/3 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM, OVER-TEMPERATURE ACTUATOR 

EFFECTS/RATIONALE : 

REMAINING TWO SYSTEMS CANNOT OVERCOME JAMMED VALVE; LOSS OF BODY 
FLAP MOTION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-12 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

9/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

BODY FLAP 

FLIGHT: 

3/3 

MDAC ID: 

112 

ABORT: 

3/3 

ITEM: 

CHECK VALVE 



FAILURE MODE 

: FAILS OPEN 



LEAD ANALYST 

: J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) CHECK VALVE 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

/NA 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 


REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: CONTAMINANT IN SYSTEM, SPRING BREAKS OR RELAXES 

EFFECTS/RATIONALE : 

SYSTEM OPERATES NORMALLY ON TWO SYSTEMS. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-13 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 113 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: RECIRCULATION VALVE 

FAILURE MODE: FAILS CLOSED 

LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) RECIRCULATION VALVE 

6 ) 

7) 

8 ) 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/ SAFING: 


CRITICALITIES 


HDW/FUNC 

3/3 

3/3 

/NA 

3/3 

3/3 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: BROKEN SPRING, GROSS FLUID LEAKAGE 


EFFECTS/RATIONALE : 

FAILS CLOSED-ACTUATOR RECEIVES PRESSURE <800 PSIG, AND MOVES AT 
REDUCED RATE. REMAINING SYSTEMS DRAG PISTON THROUGH SUMMING 
LINK. FULL SYSTEM CAPABILITY. FAILS CLOSED-PRESSURE SPILLS TO 
RETURN; SUMMING LINK DRAGS ACTUATOR AND HYDRAULIC MOTOR OPERATES 
NORMALLY. LEAK-PRESSURE DECAYS, HYDRAULIC BRAKE ENGAGES, AND 
RECIRCULATION VALVE OPENS. SUMMING LINK DRAGS ACTUATOR. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-14 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 114 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: SUMMING LINK 

FAILURE MODE: JAMMED 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6 ) 

7) 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 




REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

CONTAMINATION JAMS SUMMING LINK-LOSS OF ALL BODY FLAP MOTION AND 
CONTROL. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-15 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

9/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

BODY FLAP 

FLIGHT: 

3/1R 

MDAC ID: 

115 

ABORT: 

3/1R 

ITEM: 

SUMMING LINK 



FAILURE MODE 

: FRACTURED 



LEAD ANALYST 

: J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/ SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: FATIGUE 

EFFECTS/RATIONALE : 

ONE LINK- ARM OR LINK-END FRACTURES, REMAINING TWO SYSTEMS DRIVE 
THE BODY FLAPS. NO PERFORMANCE DEGREDATION. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-16 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 116 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: HYDRAULIC MOTOR 

FAILURE MODE: FAILS TO START 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) HYDRAULIC MOTOR 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: GROSS FLUID LEAKAGE, LOSS OF HYDRAULIC PRESSURE, MOTOR 

BEARING FAILURE 

EFFECTS/RATIONALE : 

HYDRAULIC MOTOR DOES NOT PRODUCE TORQUE/SHAFT OUTPUT; REMAINING 
TWO LOOPS DRIVE BF NOMINALLY. PRESSURE DECAYS BELOW 850 PSI, 
ISO- VALVE OPENS, AND REMAINING LOOP PRESSURE BYPASSES CONTROL 
VALVE ACTUATOR. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-17 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 117 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: HYDRAULIC MOTOR 

FAILURE MODE: FRACTURED SHAFT 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSEMBLY 

7) HYDRAULIC MOTOR 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AOA: 

1/1 

DEORBIT: 
LANDING/ SAFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 

CAUSES: FATIGUE 


EFFECTS/RATIONALE : 

SHAFT SHEARS; LOSS OF TORQUE/SHAFT OUTPUT. SYSTEM MUST BE 
ISOLATED AND HYDRAULIC BRAKE APPLIED TO PREVENT TORQUE SPILL-OUT 
FROM DIFFERENTIAL GEARBOX. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-18 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

BODY FLAP 

FLIGHT: 

2/1R 

MDAC ID: 

118 

ABORT: 

2/1R 

ITEM: 

HYDRAULIC BRAKE 



FAILURE MODE 

: FAILS TO BRAKE 



LEAD ANALYST 

': J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSEMBLY 

7) HYDRAULIC BRAKE 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

2/1R 

LIFTOFF: 

3/3 

TAL: 

2/1R 

ONORBIT: 

/ NA 

AO A: 

2/1R 

DEORBIT: 

LANDING/SAFING: 

2/1R 

3/3 

ATO: 

2/1R 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC62 1-0056-0053 


CAUSES: GROSS FLUID LEAKAGE; LOSS OF HYDRAULIC PRESSURE; BROKEN 

RETURN SPRING 


EFFECTS/RATIONALE : 

HYDRAULIC PRESSURE IS REQUIRED TO DISENGAGE BRAKE. FAILED BRAKE 

does not Prevent torque spill-out from differential gearbox. 

TORQUE SPILL-OUT IS PREVENTED BY A POWERED HYDRAULIC MOTOR. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-19 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

9/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

BODY FLAP 

FLIGHT: 

3/1R 

MDAC ID: 

119 

ABORT: 

3/1R 

ITEM: 

HYDRAULIC 

BRAKE 


FAILURE MODE 

1: FRACTURED 

SHAFT 


LEAD ANALYST 

': J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 


1) 

BODY FLAP 




2) 

ENABLE SOLENOID VALVE 



3) 

PILOT SOLENOID VALVE 



4) 

POWER SPOOL-CONTROL VALVE 



5) 

SUMMING LINK 




6) 

HYDRAULIC MOTOR/BRAKE ASSEMBLY 



7) 

HYDRAULIC BRAKE 




8) 





9) 







CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

3/1R 


LIFTOFF: 

3/3 

TAL: 

3/1R 


ONORBIT: 

/NA 

AOA: 

3/1R 


DEORBIT: 

3/1R 

ATO: 

3/1R 


LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] B 

[ F ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: FATIGUE 

EFFECTS/RATIONALE : 

SHAFT FRACTURES INTERNAL TO BRAKE HOUSING-HYDRAULIC SYSTEMS MUST 
BE SHUT-DOWN TO DETECT FAILED UNIT AND ENGAGE BRAKE TO PREVENT 
TORQUE SPILL-OUT. REMAINING TWO SYSTEMS DRIVE BODY FLAP 
NOMINALLY. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-20 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 121 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: DIFFERENTIAL GEARBOX 

FAILURE MODE: FRACTURED GEAR 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) PDU GEARTRAIN ASSY 

8) DIFFERENTIAL GEARBOX 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: FATIGUE 

EFFECTS/RATIONALE : 

FRACTURED GEAR JAMS GEARBOX OR PREVENTS TRANSMISSION OF POWER. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-21 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 122 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: DIFFERENTIAL GEARBOX 

FAILURE MODE: JAMMED GEARS (ONE SET) 

LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) PDU GEARTRAIN ASSY 

8) DIFFERENTIAL GEARBOX 

9 ) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/S AFING: 


CRITICALITIES 


HDW/FUNC 

3/3 

3/3 

/NA 

2/1R 

3/3 


ABORT 

RTLS: 

TAL: 

AOA: 

ATO: 


HDW/FUNC 

2/1R 

2/1R 

2/1R 

2/1R 


REDUNDANCY SCREENS: A [ 2 ] B [ F ] 


C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: HC621-0056-0053 


CAUSES: FRACTURED GEAR 


EFFECTS/RATIONALE : 

ONE SET OF DIFFERENTIAL GEARS JAM; TWO INPUT SHAFTS DRIVE 
REMAINING DIFFERENTIAL AT FULL CAPACITY AND RATE. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-22 


DATE: 

SUBSYSTEM: 

MDAC ID: 

ITEM: 

FAILURE MODE: JAMMED INPUT SHAFT (ONE) 

LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 



l) 

BODY FLAP 


2) 

ENABLE SOLENOID VALVE 


3) 

PILOT SOLENOID VALVE 


4) 

POWER SPOOL-CONTROL VALVE 

ir~. 

5) 

SUMMING LINK 


6) 

HYDRAULIC MOTOR/BRAKE ASSY 


7) 

PDU GEARTRAIN ASSY 


8) 

DIFFERENTIAL GEARBOX 


9) 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

9/16/86 HIGHEST CRITICALITY HDW/FUNC 

BODY FLAP FLIGHT: 3/1R 

123 ABORT: 3/1R 

DIFFERENTIAL GEARBOX 


CRITICALITIES 


- ' 

FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

*“* 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 


LIFTOFF: 

3/3 

TAL: 

3/1R 


ONORBIT: 

/NA 

AO A: 

3/1R 


DEORBIT: 
LANDING/S AFING: 

3/1R 

3/3 

ATO: 

3/1R 


REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

c [ p ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC62 1-0056-0053 


CAUSES: FRACTURED GEAR 

EFFECTS/RATIONALE : 

SHAFT JAMS; REMAINING TWO INPUTS DRIVE SYSTEM NOMINALLY. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-23 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 124 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: DRIVESHAFT 

FAILURE MODE: JAMMED OUTPUT SHAFT 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) PDU GEARTRAIN ASSY 

8) DRIVESHAFT 

9) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS: 

LIFTOFF: 3/3 TAL: 

ONORBIT: /NA AO A: 

DEORBIT: 1/1 ATO: 

LANDING/SAFING: 3/3 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: DRIVESHAFT BEARING SEIZED, BROKEN GEAR TOOTH 

EFFECTS/RATIONALE : 

JAMMED SHAFT PREVENTS BODY FLAP MOTION-LOSS OF BF CONTROL. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-24 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

9/16/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM: 

BODY FLAP 

FLIGHT: 

3/3 

MDAC ID: 

125 

ABORT: 

3/3 

ITEM: 

PDU GEARBOX 

HEATER 


FAILURE MODE 

i: FAILS ON 



LEAD ANALYST 

J. RICCIO 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) PDU GEARTRAIN ASSY 

8) PDU GEARBOX HEATER 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AO A: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/S AFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC62 1-0056-0053 


CAUSES: THERMOSTAT STUCK-ON. 

EFFECTS/RATIONALE : 

CREW CAN DISABLE HEATER, PDU GEARBOX DESIGNED TO WITHSTAND 
OVERTEMPERATURE CONDITION. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-25 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 12 6 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: PDU GEARBOX HEATER 

FAILURE MODE: ERRONEOUS SENSOR READING 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) PDU GEARTRAIN ASSY 

8) PDU GEARBOX HEATER 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: THERMOSTAT FAILS TO OPERATE PROPERLY. 

EFFECTS/RATIONALE : 

PDU GEARBOX HEATERS ARE NOT DETRIMENTAL TO GEARBOX USE. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-26 


INDEPENDENT ORBITER ASSESSMENT 

orbiter Subsystem analysis worksheet 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 127 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: PDU GEARBOX HEATER 

FAILURE MODE: BROKEN LEAD WIRE 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) PDU GEARTRAIN ASSY 

8) PDU GEARBOX HEATER 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AO A: 

DEORBIT: 

3/3 

ATO: 

LANDING/ SAFING: 

3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: EXCESSIVE VIBRATION 


EFFECTS/RATIONALE : 

REDUNDANT HEATER OPERATES SYSTEM WITHIN NOMINAL TOLERANCES. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-27 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 128 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: RVDT (4 -UNITS) 

FAILURE MODE: LOSS OF ONE SIGNAL 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSY 

7) PDU GEARTRAIN ASSY 

8) RVDT 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: SHOCK, VIBRATION, BROKEN LEAD 

EFFECTS/RATIONALE : 

ANY OF THE FOUR RVDTs CAN FEEDBACK THE BODY FLAP POSITION-NO 
PERFORMANCE DEGRATION. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-28 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 129 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: ROTARY ACTUATORS 

FAILURE MODE: FAILS TO START 

LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) HYDRAULIC MOTOR/BRAKE ASSY 

6) PDU GEARTRAIN ASSY 

7) TORQUE TUBE 

8) ROTARY ACTUATOR 

9) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS: 

LIFTOFF: 3/3 TAL: 

ONORBIT: /NA AOA: 

DEORBIT: 1/1 ATO: 

LANDING/ SAFING: 3/3 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: GEARS JAM, GEARS CRACK OR BREAK, BEARING SEIZES 


EFFECTS/RATIONALE : 

LOSS OF BODY FLAP MOTION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 C-29 


HDW/FUNC 

1/1 

1/1 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/16/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 130 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: TORQUE TUBE (FOR ROTARY ACTUATORS) 

FAILURE MODE: FRACTURED SHAFT 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 


1 ) 

BODY FLAP 


2 ) 

ENABLE SOLENOID VALVE 


3 ) 

PILOT SOLENOID VALVE 


4 ) 

POWER SPOOL-CONTROL VALVE 

— 

5 ) 

HYDRAULIC MOTOR/BRAKE ASSY 

§§ 

6 ) 

PDU GEARTRAIN ASSY 


7 ) 

TORQUE TUBE 


8 ) 


. 

9 ) 





CRITICALITIES 


:ght phase 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AOA: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 

LANDING/SAFING: 

3/3 




REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: MISMATCHED LOADS, FATIGUE, JAMMED ROTARY ACTUATOR 


EFFECTS/RATIONALE : 

LOSS OF BODY FLAP MOTION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-30 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 
BODY FLAP 
131 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: HYDRAULIC BRAKE 

FAILURE MODE: FAILS TO DISENGAGE 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL-CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSEMBLY 

7) HYDRAULIC BRAKE 

8 ) 

9 ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AO A: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

c E P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC62 1-0056-0053 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

HYDRAULIC PRESSURE IS REQUIRED TO DISENGAGE BRAKE. CONTAMINATION 
PREVENTS BRAKE FROM DISENGAGING. SYSTEM DOES NOT CONTRIBUTE 
MOTION AND TORQUE TO DIFFERENTIAL. REMAINING TWO SYSTEMS DRIVE 
BF NOMINALLY. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-31 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10/16/86 
BODY FLAP 
132 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/1R 


ITEM: FILTER 

FAILURE MODE: PLUGGED 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) FILTER 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/1R 

LIFTOFF: 

3/3 

TAL: 

3/1R 

ONORBIT: 

/NA 

AOA: 

3/1R 

DEORBIT: 

3/1R 

ATO: 

3/1R 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: CONTAMINATED HYDRAULIC SYSTEM 

EFFECTS/RATIONALE : 

PLUGGED FILTER DECREASES HYDRAULIC PRESSURE TO PDU. 
RECIRCULATION VALVE OPEN DIVERTING FLUID TO RETURN LINE. BF 
OPERATES NOMINALLY ON TWO SYSTEMS. 


REFERENCES : 


REPORT DATE 11/19/86 


12:45 


C-32 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

HDW/FUNC 
1/1 
1/1 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) ACTUATOR-CONTROL VALVE 

5) SUPPLY ORIFICE #1 

6 ) 

7) 

8 ) 

9) 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 
BODY FLAP 
133 


HIGHEST CRITICALITY 
FLIGHT: 
ABORT: 


ITEM: 

FAILURE MODE: 


SUPPLY ORIFICE #1 
FAILS CLOSED 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRE LAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

LANDING/SAFING: 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: CONTAMINATED HYDRAULIC FLUID 

EFFECTS/RATIONALE : 

ENABLE AND PILOT VALVES OPEN ALLOWING HYDRAULIC FLUID TO RELEASE 
BRAKE. HOWEVER, ORIFICE IS PLUGGED AND FLUID CANNOT DRIVE MOTOR. 
TORQUE FROM TWO REMAINING SYSTEMS SPILLS-OUT OF MOTOR. SYSTEMS 
MUST BE SHUT-DOWN TO DETECT FAILED PDU. 


REFERENCES: 


REPORT DATE 11/19/86 


12:45 


C-33 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 
BODY FLAP 
134 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: ORIFICE #2 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: J. RICCIO 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) ACTUATOR-CONTROL VALVE 

5) ORIFICE #2 

6) 

7) 

3) 

9) 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/SAFING: 


CRITICALITIES 


HDW/FUNC 

3/3 

3/3 

/NA 

3/3 

3/3 


ABORT 
RTLS: 
TAL: 
AO A: 
ATO: 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC62 1-0056-0053 


CAUSES: CONTAMINATED HYDRAULIC FLUID 


EFFECTS/RATIONALE : r ~ 

ENABLE AND PILOT SOLENOIDS OPEN ALLOWING FLUID TO TRANSLATE 
ACTUATOR - CONTROL VALVE. ORIFICE IS PLUGGED, AC TUATO R - CONTROL 
VALVE TRANSLATES FASTER THAN THE TWO REMAINING SYSTEMS. NORMAL 
BODY FLAP OPERATION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-34 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 20/86 
BODY FLAP 
135 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: ORIFICE #3 

FAILURE MODE: FAILS CLOSED 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) ACTUATOR-CONTROL VALVE 

5) ORIFICE #3 

6 ) 

7) 

8 ) 

9 ) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

/ NA 

AOA: 

3/3 

DEORBIT: 

3/3 

ATO: 

3/3 

LANDING/SAFING: 

3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: CONTAMINATED HYDRAULIC FLUID 

EFFECTS/RATIONALE : 

ENABLE AND PILOT SOLENOIDS OPEN ALLOWING FLUID TO TRANSLATE 
ACTUATOR - CONTROL VALVE. ORIFICE IS PLUGGED, ACTUATOR - CONTROL 
VALVE TRANSLATES FASTER THAN THE TWO REMAINING SYSTEMS. NORMAL 
BODY FLAP OPERATION. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-35 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 9/17/86 
SUBSYSTEM: BODY FLAP 
MDAC ID: 136 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: RVDT 

FAILURE MODE: LOSS OF SIGNAL 


LEAD ANALYST: J. RICCIO SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) BODY FLAP 

2) ENABLE SOLENOID VALVE 

3) PILOT SOLENOID VALVE 

4) POWER SPOOL - CONTROL VALVE 

5) SUMMING LINK 

6) HYDRAULIC MOTOR/BRAKE ASSEMBLY 

7) PDU GEARTRAIN ASSEMBLY 

8) RVDT 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT: 

/NA 

AO A: 

1/1 

DEORBIT: 

1/1 

ATO: 

1/1 


LANDING/SAFING: 3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: AFT FUSELAGE 

PART NUMBER: MC621-0056-0053 


CAUSES: VIBRATION CAUSES BROKEN BRACKET 

EFFECTS/RATIONALE : 

IF BRACKET SUPPORTING ALL RVDTs FRACTURES, THE BODY FLAP POSITION 
CAN NOT BE DETERMINED. 


REFERENCES : 


REPORT DATE 11/19/86 12:45 


C-36 



APPENDIX D 

POTENTIAL CRITICAL ITEMS 


MDAC ID 

ITEM 

FAILURE MODE 

109 

Actuator control valve 

Fails null position 

110 

Actuator control valve 

Fails to return 

111 

Actuator control valve 

Jammed 

114 

Summing link 

Jammed 

115 

Summing link 

Fractured 

116 

Hydraulic motor 

Fails to start 

117 

Hydraulic motor 

Fractured shaft 

118 

Hydraulic brake 

Fails to brake 

119 

Hydraulic brake 

Fractured shaft 

121 

Differential gearbox 

Fractured gear 

122 

Differential gearbox 

Jammed gear 

123 

Differential gearbox 

Jammed shaft 

124 

Driveshaft 

Jammed 

129 

Rotary actuator 

Fails to start 

130 

Torque tube 

Fractured 

131 

Hydraulic brake 

Fails to disingage 

132 

Filter 

Plugged 

133 

Supply orifice #1 

Fails closed 

136 

RVDT 

Loss of signal 




